SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nvdimm: fix header pointer in nvdimm_build_nfit()

Browse Source 
In the current nvdimm_build_nfit(), the pointer 'header' initially equals
to table_data->data + table_data->len. However, the following
g_array_append_vals(table_data, structures->data, structures->len)
may resize and relocate table_data->data[]. Therefore, the usage of 'header'
afterwards may be illegal.

This patch fixes this issue by storing an offset within table_data->data[]
(rather than an address) in 'header'.

Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Haozhong Zhang 2015-12-25 10:57:42 +08:00 committed by Michael S. Tsirkin
parent 6bb9ead762
commit c8e6c93857
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/acpi/nvdimm.c
View File

@ -353,16 +353,18 @@ static void nvdimm_build_nfit(GSList *device_list, GArray *table_offsets,
GArray *table_data, GArray *linker) GArray *table_data, GArray *linker)
{ {
GArray *structures = nvdimm_build_device_structure(device_list); GArray *structures = nvdimm_build_device_structure(device_list);
void *header; unsigned int header;
acpi_add_table(table_offsets, table_data); acpi_add_table(table_offsets, table_data);
/* NFIT header. */ /* NFIT header. */
header = acpi_data_push(table_data, sizeof(NvdimmNfitHeader)); header = table_data->len;
acpi_data_push(table_data, sizeof(NvdimmNfitHeader));
/* NVDIMM device structures. */ /* NVDIMM device structures. */
g_array_append_vals(table_data, structures->data, structures->len); g_array_append_vals(table_data, structures->data, structures->len);
build_header(linker, table_data, header, "NFIT", build_header(linker, table_data,
(void *)(table_data->data + header), "NFIT",
sizeof(NvdimmNfitHeader) + structures->len, 1, NULL); sizeof(NvdimmNfitHeader) + structures->len, 1, NULL);
g_array_free(structures, true); g_array_free(structures, true);
} }